I worked at a biotech startup about 20 years ago

> For reasons I can't remember, I was able to send emails through the company's Windows email server under any name that I wanted. The glorious days of open relays, back when spam was in its infancy. Today it's mostly done on a whitelist basis to let tools like JIRA or Gitlab send notifications under the name of users themselves instead of some noreply address.

For reasons I can't remember, I was able to send emails through the company's Windows email server under any name that I wanted. I know of several fortune 100 companies that still allow this due to the way they set up email protection with o365 and Proofpoint, ironically. not naming them. I've done similar pranks and got by with the skin of my teeth but would not recommend people do this early in their career especially if leadership are sensitive to embarrassment.

When I was junior IT at a smaller place (150ish people), we set up DMARC for the first time in "quarantine" mode. Plan was to eventually set it to full reject but only if folks didn't report issues for a month or so. While it was in quarantine mode, I asked my boss if we could use it for an object lesson in email trust at our next security training. He said sure, got permission from the CEO, and then an hour before the next quarterly IT security training meeting everyone in the company got an email from the CEO's address saying "URGENT all-hands company meeting, attendance mandatory!" (which came from a Postfix running under my desk, sans DKIM validation record). In DKIM "quarantine" mode, everyone's Outlook flagged the message with a banner or popup or something saying it was suspicious, I think it also had a prompt to auto-spambox future validation failures. Plenty of folks saw that an…